ON REMARKS OF LIFTING PROBLEMS FOR ELLIPTIC CURVES 1 ...

More documents

Recommendations

Info

2 HWAN JOON KIM, JUNG HEE CHEON, AND SANG GEUN HAHN We will show that it is easy to compute the coefficients of the dependence equation among linearly dependent rational points by the 2-descent method. This means that if we can solve the lifting problem, we can solve the ECDLP by reducing the dependence equation to a finite field. 1 For the case of the ECDLP over F 2 m, we propose the lifting problem to a function field F 2 (t). In this paper, we show that the 2-descent method can be applied to the case of a function field similarly to the case of the rational field. That is, we show that the lifting problem implies the ECDLP not only over a prime field F p , but also over a extension field F 2 m. 2 Moreover, we show that the lifting problem for an elliptic curve over Z/nZ can be used in computing the order of a given point of an elliptic curve defined over Z/nZ and this solves the Integer Factorization Problem (IFP). It is a generalization of the Koblitz’s comment in [13]. He also noted that the lifting problem implies the discrete logarithm problem (DLP) on a finite field because a finite field is explicitly isomorphic to a singular reduction of an elliptic curve over Q to the finite field. It is very surprising and remarkable that the important problems (ECDLP, IFP, DLP) in cryptography are implied by one problem because it means that the cryptosystems based on these problems may be cracked by one method. Unfortunately, the lifting problem may or may not be harder than the original problem. In fact, Silverman showed that the rank of the lifted elliptic curve tends to be the same as the number of the lifted points and that even when the rank is smaller than the number of lifted points, the size of the coefficients of the linearly dependence relation among the lifted points are very small, which means that the given ECDLP is trivial [4]. In this paper, we note that if we can find a non-trivial point of the kernel of the reduction map from a lifted elliptic curve to the elliptic curve given by ECDLP, then we can solve the lifting problem. Moreover, we find the relation between the size of the coefficients of the linearly dependence relation among the lifted points and the minimum of the canonical heights of the points in the kernel of the reduction map. Unfortunately, the minimum of the canonical heights of the points in the kernel of the reduction map is O(|Ẽ(F p)|), which implies that a non-trivial point in the kernel is too large to be found by brute force search so that some additional technique is required to solve the lifting problem. 2. Lifting Problem and ECDLP ¿From now on, we assume that n is a square free integer and that Ẽ is an elliptic curve defined over Z/nZ [7]. 3 In particular, if n is a prime p, then Ẽ is an elliptic curve defined over a finite field F p . In this section, we first define the lifting problem for Ẽ and we show that it implies the elliptic curve discrete logarithm problem (ECDLP) on Z/nZ. Secondly, we introduce the 2-descent method to check the linearly dependence between rational points of an elliptic curve defined over Q and to compute its coefficients, which is necessary to connect between the lifting problem and the ECDLP. Finally, we show that the 2-decent method can be applied to the case of function field so that the 1 Silverman proposed a similar method named by ‘Xedni calculus’ independently [13]. 2 We consider it can be generalized to small characteristic p. 3 For ECDLP, we consider only the case n is a prime. The case of a composite number n is considered for IFP in the below.
ON REMARKS OF LIFTING PROBLEMS FOR ELLIPTIC CURVES 3 lifting problem implies the ECDLP not only on Z/nZ but also on the general finite fields F p m. 2.1. Lifting Problem. To begin with, we define the lifting problem. Definition 2.1. Let Ẽ be an elliptic curve over Z/nZ and ˜P 1 , ˜P 2 , · · · , ˜P r be the points of Ẽ(Z/nZ). We call the elliptic curve E over Q by the lifted elliptic curve of Ẽ if Ẽ is isomorphic to the reduction of E modulo n, namely E ≡ Ẽ mod n. In this case, a point P of E(Q) is a lifted point of ˜P of Ẽ(Z/nZ), if it is congruent to ˜P modulo n. We define the lifting for (Ẽ, ˜P 1 , · · · , ˜P r ) to be the pair (E, P 1 , · · · , P r ) of its lifted elliptic curve E and lifted points P i ’s of ˜P i ’s respectively. Furthermore, if the lifted points P i ’s are linearly dependent, then we call it by the “good” lifting. The lifting problem means to find an good lifting for given (Ẽ, ˜P 1 , · · · , ˜P r ). In general, if we omit the condition of the linearly dependent lifted points, we can easily construct the lifting as follows. Let Ẽ be an elliptic curve defined on Z/nZ given by the following Weierstrass equation Ẽ : y 2 + a 1 xy + a 3 y = x 3 + a 2 x 2 + a 4 x + a 6 , a i ∈ Z. Then, for any rational numbers t j (j = 1, · · · , 7) of which the numerators are prime to n, the following elliptic curve E becomes the lifted elliptic curve of Ẽ; E : (1 + nt 1 )y 2 + (a 1 + nt 2 )xy + (a 3 + nt 3 )y = (1 + nt 4 )x 3 + (a 2 + nt 5 )x 2 + (a 4 + nt 6 )x + (a 6 + nt 7 ). Now, suppose ˜P 1 , · · · , ˜P r are the points of Ẽ(Z/nZ) where ˜P i = (x i , y i ). By linear algebra, we can choose some rational numbers t j ’s so that each of (x i , y i )’s becomes an integral point of E, that is, each of (x i , y i )’s becomes a lifted point by itself. Since the number of indeterminants t j ’s is 7, we can make 6 points ˜P i ’s the lifted points by themselves. 4 Therefore, we can easily construct infinitely many liftings for a given (Ẽ, ˜P 1 , · · · , ˜P r ) if r < 7. Unfortunately, the lifted points constructed in such way are usually inclined to be linearly independent. We will consider more on the good lifting in the section 4. Now, we show how to solve the ECDLP on Z/nZ assuming the lifting problem is solved. Suppose Ẽ is an elliptic curve defined over Z/nZ with ˜P , ˜Q in Ẽ(Z/nZ). Step 1 Take r distinct points ˜P i in Ẽ(Z/nZ) which are linear combinations of ˜P and ˜Q. That is, for small integers x i ’s and y i ’s we take ˜P i = x i ˜P + yi ˜Q, i = 1, · · · , r. For example, we can take ˜P i = (i − 1) ˜P + ˜Q. Step 2 Solve a lifting problem for (Ẽ, ˜P 1 , · · · , ˜P r ). Then we get a lifting elliptic curve E/Q and linearly dependent lifted points P i ’s on E(Q). Step 3 Compute the coefficients α i ’s of the dependence equation α 1 P 1 + · · · + α r P r = O by the 2-descent method which will be explained in the next subsection. 4 If we use the homogeneous cubic equation instead of the Weierstrass equation which has 10 coefficients, we can construct a lifting with 9 lifted points [13].
Page 1: ON REMARKS OF LIFTING PROBLEMS FOR
Page 5 and 6: ON REMARKS OF LIFTING PROBLEMS FOR
Page 15: ON REMARKS OF LIFTING PROBLEMS FOR

ON REMARKS OF LIFTING PROBLEMS FOR ELLIPTIC CURVES 1 ...

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?